How Batata verifies scores
Every leaderboard on Batata, every challenge and every best on a profile rests on one promise: the number is real. The game you played did not get to decide that, and neither did the device it ran on. Here is how a score travels from a run to a board.
A run starts with a token
When a game is about to start, the platform asks Batata's servers for a play token: a short-lived, single-purpose credential tied to that game and that session. The game never sees anything else about you. Without a token there is no run to score, which is also why a page that merely shows a game does not count as a play; the first real input does.
The game is sealed
A game on Batata runs in a sandbox on a separate origin: no cookies, no storage of its own, no network, no way to reach the page around it. The only things it can send out are a handful of messages, and a score is one of them. It cannot read your account, cannot write to a board, and cannot be told by a modified copy of itself to report anything to anyone but the platform.
The server decides
A submitted score arrives with its token and the length of the run, and it lands as pending. The server checks that the token is live and unused, that the run is plausible for that game, and that the device is not submitting faster than a human plays. Only a score that survives becomes verified, and only verified scores rank. The check happens after the run so that a player never waits on it.
What you see
On the screen a new best appears at once, marked pending, and turns verified a moment later. A run the server refuses is told to you, never shown as accepted. The same path is used for every run, online or synced later from the app, so there is no second door. A bragging right is only worth something if it cannot be forged, and that is the whole reason the machinery exists.